Mastodawn

#AkzoNobel, a Netherlands-based global paint manufacturer, has confirmed a #cyberattack affecting one of its United States sites. The company said the intrusion was contained, while the #Anubis #ransomware group claimed it stole 170 GB of data, including employee and financial records.

For the latest discoveries in cyber research for the week of 9th March, please download our Threat Intelligence Bulletin: https://research.checkpoint.com/2026/9th-march-threat-intelligence-report/

#CheckPoint #ThreatIntelligence

9th March – Threat Intelligence Report - Check Point Research

For the latest discoveries in cyber research for the week of 9th March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES AkzoNobel, a Netherlands-based global paint manufacturer, has confirmed a cyberattack affecting one of its United States sites. The company said the intrusion was contained, while the Anubis ransomware group claimed it stole […]

Check Point Research

Daniel Kuhl ✌🏻☮️☕️Mar 13

#CheckPoint Research has profiled #SilverDragon, a Chinese-aligned group linked to #APT41 that targeted government and enterprise networks across Southeast Asia and Europe. Recent operations used the #GearDoor #backdoor with SSHcmd and SilverScreen, enabling remote access, covert screen capture, and stealthy control after #phishing and server exploitation.

https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/

Silver Dragon Targets Organizations in Southeast Asia and Europe - Check Point Research

Key Findings Introduction In recent months, Check Point Research (CPR) has been tracking a sophisticated, Chinese-aligned threat group whose activity demonstrates operational correlation with campaigns previously associated with APT41. We have designated this activity cluster as Silver Dragon. This group actively targets organizations in Southeast Asia and Europe, with a particular focus on government entities. […]

Check Point Research

Daniel Kuhl ✌🏻☮️☕️Mar 13

#CheckPoint Research revealed that, amid the ongoing conflict with Iran, IP cameras in Israel, Qatar, Bahrain, Kuwait, the UAE, and Cyprus have been intensively targeted. Notably, these countries have also experienced significant missile activity from Iran. The findings align with the assessment that Iran incorporates compromised cameras into its operational doctrine, using them both to support missile operations and to conduct ongoing battle damage assessment (BDA).

https://research.checkpoint.com/2026/interplay-between-iranian-targeting-of-ip-cameras-and-physical-warfare-in-the-middle-east/

Interplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle East - Check Point Research

Key Findings Introduction As highlighted in the Cyber Security Report 2026, cyber operations have increasingly become an additional tool in interstate conflicts, used both to support military operations and to enable ongoing battle damage assessment (BDA). During the 12-day conflict between Israel and Iran in June 2025, the compromise of cameras was likely used to support […]

Check Point Research

Daniel Kuhl ✌🏻☮️☕️Mar 13

Check your #Cisco #SDWAN deployments about Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127

How to mitigate #vulnerabilities in Cisco SD-WAN Systems can be found here: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems

Daniel Kuhl ✌🏻☮️☕️Mar 6

For the latest discoveries in cyber research for the week of 2nd March, please download our Threat Intelligence Bulletin: https://research.checkpoint.com/2026/2nd-march-threat-intelligence-report/

#CheckPoint #CyberSecurity #ThreatIntelligence

2nd March – Threat Intelligence Report - Check Point Research

For the latest discoveries in cyber research for the week of 2nd March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Wynn Resorts, a United States-based casino and hotel operator, has confirmed that employee data was accessed following an extortion threat linked to ShinyHunters. The company said operations were not disrupted. Reports indicate […]

Check Point Research

Daniel Kuhl ✌🏻☮️☕️Mar 5

#CheckPoint Research has discovered critical #vulnerabilities in #Anthropic’s #Claude Code that allow attackers to achieve remote code execution and steal API credentials through malicious project configurations. Stolen keys can provide access to shared Workspaces for file access and tampering. Anthropic patched the issues, including CVE-2025-59536.

https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/

Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536 | CVE-2026-21852 - Check Point Research

By Aviv Donenfeld and Oded Vanunu Executive Summary Check Point Research has discovered critical vulnerabilities in Anthropic’s Claude Code that allow attackers to achieve remote code execution and steal API credentials through malicious project configurations. The vulnerabilities exploit various configuration mechanisms including Hooks, Model Context Protocol (MCP) servers, and environment variables -executing arbitrary shell commands […]

Check Point Research

Daniel Kuhl ✌🏻☮️☕️Mar 4

#CheckPoint Research has published its Untold Stories of 2025, a compilation covering multiple notable campaigns that occurred during 2025. These include exploitation of #Microsoft #SharePoint (“ToolShell”), and adversary-in-the-middle #phishing used to bypass MFA, as well as state-linked operations attributed to groups such as Camaro Dragon and COLDRIVER. The report also highlights evolving command-and-control techniques observed across Europe and Central Asia.

https://research.checkpoint.com/2026/2025-the-untold-stories-of-check-point-research/

2025: The Untold Stories of Check Point Research - Check Point Research

Introduction Check Point Research (CPR) continuously tracks threats, following the clues that lead to major players and incidents in the threat landscape. Whether it’s high-end financially-motivated campaigns or state-sponsored activity, our focus is to figure out what the threat is, report our findings to the relevant parties, and make sure Check Point customers stay protected. […]

Check Point Research

Daniel Kuhl ✌🏻☮️☕️Mar 3

#CheckPoint Research summarizes five key Iranian threat actor clusters relevant to the current conflict in the Middle East. It outlines the main TTPs these groups have recently used against targets in the Middle East and the United States and shares six defensive measures IT teams should take to help prevent attacks during the ongoing conflict.

https://blog.checkpoint.com/research/what-defenders-need-to-know-about-irans-cyber-capabilities/

What Defenders Need to Know about Iran’s Cyber Capabilities

Check Point Blog

Daniel Kuhl ✌🏻☮️☕️Mar 3

Back at our Munich office for a week full of Python training with the great Kirk Byers. Let's see what cool things we'll build around our Check Point Software Gaia and Management API's. 🤓

Daniel Kuhl ✌🏻☮️☕️Feb 27

#University of #Mississippi Medical Center, an academic #healthcare system in Mississippi, has suffered a #ransomware attack that forced closures across its clinic network and disrupted access to electronic medical records. The organization canceled elective procedures and shifted to manual processes. Systems were taken offline and no ransomware group claimed responsibility.

https://research.checkpoint.com/2026/23rd-february-threat-intelligence-report/

23rd February – Threat Intelligence Report - Check Point Research

For the latest discoveries in cyber research for the week of 23rd February, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES France’s Ministry of Economy has disclosed a data breach resulted from an unauthorized access to the national bank account registry FICOBA, impacting information tied to 1.2 million accounts. Exposed data includes names, […]

Check Point Research